Let me see if I can explain the logic to you: security is about competing costs between attackers and defenders. DoH is cost-effective --- free, in fact, for the huge number of home/private users who benefit from it, and directly addresses a real threat they face.
Passive DNS security monitoring, on the other hand, is just another metaphorical box enterprise people stack on the giant shambolic stack of boxes they’ve been sticking on their networks for 20 years in the hopes of protecting endpoints without protecting endpoints.
I am fine, really, truly, just fine if Allstate or Schwab wants to monitor DNS on their networks. They can use DoT.
It is however super super super fucking weird for DNS security product vendors to be telling home users that they should choose a DNS privacy solution that networks can disable without consent in order to make life better for Schwab and Allstate. They don’t need the help.
